Managing Roles and Identity Governance

In this chapter, you will learn about Azure AD Privileged Identity Management (PIM) and how it enables you to manage, control, and monitor access to resources within Azure AD. PIM can help you identify and minimize the number of people who have access to sensitive or secure information and resources within your organization.

You will also explore how to implement and manage Azure AD entitlement management, which can be used to grant users access to a set of applications and sites within Microsoft 365, and finally access reviews, which are designed to allow users and admins to regularly review standing access to resources and assess where there may be stale permissions that are no longer required.

This chapter will cover the following topics:

• Planning and configuring PIM
• Planning and configuring entitlement management
• Planning and configuring access reviews

Planning and configuring PIM

Azure AD PIM enables you to take greater control of your privileged accounts within Azure AD. So, what exactly is a privileged account? Essentially, this is any user account within your Microsoft 365 environment that grants elevated privileges above the scope of a standard user.

By default, Microsoft 365 standard user accounts are created without any sort of administrative privileges. However, it may be necessary to grant certain users elevated privileges as per their jobs. There are many built-in administrator roles within Microsoft 365 for this, including (but not limited to) the following:

• Billing Administrator
• Exchange Administrator
• Global Administrator
• Helpdesk Administrator
• Service Administrator
• SharePoint Administrator
• Teams Administrator
• User Administrator
• Privileged Role Administrator

If you’d like to know more, please refer to the Further reading section at the end of this chapter.

Now...

Planning and configuring entitlement management

Azure AD entitlement management is Microsoft’s identity governance capability through which you can automate who has access to what and for how long. In this section, we will learn how to create access packages, which are used to grant groups of users (both internal and external) access to a collection of roles and settings to simplify access, administration, and lifecycle management.

Entitlement management is available with an Azure AD Premium P2 license and enables organizations to do the following:

• Control access to applications, groups, teams, and SharePoint sites, using multi-stage approval, time-limited assignments, and recurring access reviews
• Automatically provide users with access to resources based on the user’s properties, such as a department or location, and remove access should such properties change
• Use delegation to allow non-administrative users the ability to create access packages
...

Planning and configuring access reviews

Azure AD access reviews are a feature of Azure AD Premium P2. They enable administrators to ensure that users within the tenant have the appropriate level of access. Access reviews are also useful for weeding out stale accounts or accounts that are not often used. Users can participate in this process themselves, or their supervisors can review their current level of access. Once a review is completed, changes can be made and access can be revoked from users, as deemed appropriate.

To create and execute an access review, you need to follow these steps:

1. Log in to the Azure portal as either a Global Administrator or a User Administrator. Navigate to Azure Active Directory | Identity Governance and select Access reviews.
2. Choose the New access review option:

Figure 4.32: Access reviews

3. You can select either Teams + Groups or Applications. For this example, create an access review by selecting...

Summary

This chapter introduced you to the principles of PIM, entitlement management, and access reviews. You explored the steps to diligently plan your PIM configuration and configure and assign roles to your users and resources with the principle of least privilege applied. You also learned how to make users eligible for privileged access roles to gain JIT access, how to assign permanent access to privileged roles when required, and how to remove this access when it’s no longer required.

After that, you looked at the various monitoring capabilities of PIM, which enable you to be appropriately informed regarding your PIM configuration and ensure that access is granted only when it is required.

You also examined access packages to collate features and settings to be targeted to groups of users and control lifecycle and access reviews to check users’ access permissions to ensure they are appropriate and remove stale access permissions.

In the next chapter, you...

Questions

1. Which of the following is not one of the functions of PIM?
   1. Making a user eligible for a role
   2. Making a service principal eligible for a role
   3. Removing a role assignment
   4. Approving a role request
2. True or false? You can configure Azure AD entitlement management with an Azure AD Premium P1 subscription.
   1. True
   2. False
3. In the PIM Azure AD roles page, which of the following is not one of the available options?
   1. Access
   2. Assign
   3. Approve
   4. Activate
4. Which of the following is not an available option when configuring an access package for entitlement management?
   1. For users in your directory
   2. For users not in your directory
   3. None (auto apply by policy assignment)
   4. None (administrator direct assignments only)
5. True or false? Entitlement management access packages can be targeted at users based on attributes such as their department.
   1. True
   2. False
6. When a user requires approval in order to be granted JIT access to a privileged role, which two methods can they use to see whether their request has been...

Further reading

Please refer to the following links for more information regarding what was covered in this chapter:

• What is Azure AD Privileged Identity Management?: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure?wt.mc_id=4039827
• Getting started with using Privileged Identity Management: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started?wt.mc_id=4039827
• Viewing activity and audit history for Azure resource roles in Privileged Identity Management: https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/azure-pim-resource-rbac?wt.mc_id=4039827
• What is Azure AD entitlement management? https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-overview?WT.mc_id=M365-MVP-4039827
• Manage access to resources in Active Directory entitlement management using Microsoft Graph APIs: https://learn...

The rest of the chapter is locked